CVE-2026-82518: Akamai CLI before 2.0.6 Path Traversal via cli.json Command Names

Published Nov 10, 2026

Updated

Akamai CLI before 2.0.6 contains a path traversal vulnerability that allows malicious packages to write files outside the install directory via unvalidated commands[].name values in cli.json. Attackers who convince victims to install or update a package can use '..' segments to overwrite executables on the user's PATH, persisting after uninstall.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Akamai CLI to a version that resolves this vulnerability.
Fixed in 2.0.6

Event History

Nov 10, 2026

CVE Published

via MITRE·04:32 PM

Data Sourced

via MITRE·04:32 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of Akamai CLI versions before 2.0.6 are exposed if they install or update a malicious package. Exploitation requires the victim to be convinced to perform that package installation or update.

What can a malicious package do?

A malicious package can use '..' path segments in commands[].name within cli.json to write files outside the package install directory. This can overwrite executables on the user's PATH and may persist even after the package is uninstalled.

Does exploitation require authentication or direct access to the target system?

No privileges are required according to the supplied vector, but user interaction is required. The attacker needs to induce the victim to install or update the malicious package.

What version resolves the issue?

Upgrade Akamai CLI to version 2.0.6 or later. Versions before 2.0.6 are affected.

CVE-2026-82518: Akamai CLI before 2.0.6 Path Traversal via cli.json Command Names

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What can a malicious package do?

Does exploitation require authentication or direct access to the target system?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What can a malicious package do?

Does exploitation require authentication or direct access to the target system?

What version resolves the issue?